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Abstract 

This  paper  outlines  the  recent  development  of  a  prototype  tool  suite  that  implements  a  work-centered  approach  for 
insurgency  campaign  analysis.  The  analytical  approach  is  built  around  the  construction  of  a  linked  set  of  beliefs 
that  form  the  work  control  structure  of  an  insurgency  movement  and  its  operational  campaign.  The  work  control 
structure  reflects  a  sensemaking  model  of  how  an  organization  such  as  an  insurgency  movement  combines  high  level 
intent  with  work  system  capability  to  produce  a  stream  of  actions  along  various  pathways  of  influence.  The 
prototype  tool  suite  enables  the  analyst  to  instantiate  the  set  of  beliefs  with  streams  of  observable  events  gleaned 
from  intelligence  reports  and  news  reports.  As  these  events  are  added  to  the  model,  the  analyst  uses  them  to  adjust 
the  evidentiary  strengths  of  the  belief  elements  and,  ultimately,  to  identify  emergent  story  lines  that  provide  a 
plausible  explanation  of  the  insurgency  movement's  campaign  strategy.  The  paper  discusses  how  this  approach 
offers  advantages  over  existing  methods  of  intelligence  analysis.  It  then  outlines  the  functional  architecture  of  the 
tool  suite  and  provides  a  brief  hypothetical  illustration  of  how  it  can  be  used  to  address  the  complexity  of  a  modern 
insurgency  movement. 

Introduction:  The  Need  for  Insurgency  Campaign  Analysis 

Considerable  attention  has  been  focused  in  recent  years  on  developing  methods  and  approaches  for 
understanding  the  structure  and  operation  of  transnational  insurgency  movements.  Interest  in  such  tools  generally 
stems  from  a  desire  to  proactively  detect  and  thwart  the  use  of  weapons  of  mass  destruction  against  the  United  States 
by  specific  terrorist  organizations.  In  a  related  area,  interest  also  exists  within  the  US  military  for  tools  that  can  assist 
operational  planners  in  systematically  understanding  and  targeting  different  types  of  insurgency  groups  operating 
within  a  specific  combatant  region.  In  response  to  such  interest,  the  present  paper  explores  a  new  approach  to 
understanding  transnational  insurgency  movements  -an  approach  based  on  a  fundamental  analysis  of  the  knowledge 
creation  process  inherently  required  by  such  movements  for  planning  and  successfully  executing  the 
accomplishment  of  their  political  intent.  Labeled  “campaign  analysis,”  this  approach  identifies  the  invariant  aspects 
of  this  socio-cognitive  process  and  uses  them  to  frame  the  collection,  interpretation,  and  integration  of  intelligence 
data  into  a  predictive  understanding  of  an  insurgency  movement  as  it  operates  to  gain  control  within  a  specific 
country  or  region.  By  focusing  at  the  fundamental  level  of  knowledge  creation,  the  resulting  framework  allows  an 
understanding  of  insurgency  movements  to  be  constructed  in  a  manner  that  is  unencumbered  by  the  constraints  of 
western  organizational  thinking.  The  present  paper  presents  a  general  outline  of  this  new  approach  and  illustrates 
how  it  could  be  translated  into  a  collaborative  tool  for  evidence  management  and  predictive  battlespace 
understanding. 

Existing  Analytical  Approaches 

A  brief  review  of  existing  analytical  approaches  to  understanding  modem  insurgency  movements  and  terrorist 
operations  reveals  a  number  of  significant  shortcomings.  Considered  together,  these  shortcomings  suggest  the  need 
for  a  deeper  and  more  fundamental  framework  for  constmcting  a  predictive  understanding  of  such  movements. 

Massive  Data  Collection  with  Automated/Aided  Pattern  Recognition 

Automated  pattern  recognition  approaches  have  been  proposed  for  searching  massive  quantities  of  both  open- 
source  and  classified  intelligence  data  to  reveal  semantic  relationships  and  patterns  among  key  people,  events, 
facilities,  and  other  objects  relevant  to  terrorist  organizations  and  their  operations.  One  such  analytical  effort  was  the 


1  Approved  for  public  release,  AFRL-WS  07-0685,  27  March  2007. 


1 


Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 
VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 
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Defense  Advanced  Research  Project  Agency’s  (DARPA)  Terrorism  Information  Awareness  (TIA)  program2,  a 
project  that  was  later  cancelled  by  Congress  due  to  a  controversy  regarding  its  alleged  violation  of  US  citizen 
privacy  rights.  Similar  analytical  approaches  have  been  more  recently  undertaken  within  the  intelligence  community 
as  part  of  the  Advanced  Research  and  Development  Activity’s  (ARDA)  Novel  Intelligence  from  Massive  Data 
(NIMD)  program.3  More  specifically,  NIMD’s  Glass  Box  project  focuses  on  tools  for  assisting  intelligence  analysts 
in  the  rapid  exploitation  of  terabytes  of  open-source  data.  Functionalities  being  developed  as  part  of  the  Glass  Box 
project  include  automated  data  capture  and  time-stamping,  analyst  annotations,  data  review  and  filtering,  plus  an 
interface  for  sharing  Glass  Box  data  with  other  applications.4 

At  the  heart  of  these  initiatives  is  the  assumption  that  such  tools,  when  combined  with  the  tacit  expertise  of 
intelligence  analysts,  will  enable  the  discovery  of  objects  and  relationships  relevant  to  constructing  a  real-time 
understanding  of  terrorist  organizations  and  operations.  While  the  value  of  advanced  information  management  and 
collaborative  work  tools  might  be  substantial,  a  basic  shortcoming  of  these  research  initiatives  is  their  ab  initio 
nature  that  fails  to  benefit  from  any  historical  understanding  of  insurgency  movements  and  terrorist  operations. 
Thus,  the  resulting  tool  set  affords  no  theoretical  framework  for  organizing  an  analysis  of  available  intelligence  data. 
Rather,  it  presumes  that  meaningful  frameworks  will  emerge  through  a  serendipitous  process  of  trial  and  discovery. 
Ironically,  such  an  approach  seems  to  reverse  the  thinking  of  the  computer  science  community  from  years  ago  when 
it  was  presumed  that  machine  processing  could  completely  replace  the  need  for  human  experts.  The  strategy  taken 
now  is  one  of  providing  a  generic  set  of  information  mining  and  collaboration  tools  with  the  assumption  that  human 
expertise  will  guide  or  inform  the  interpretation  and  framing  of  available  intelligence  data  into  a  cohesive 
understanding.  While  such  an  approach  might  prove  productive  with  highly  experienced  intelligence  analysts  who 
have  access  to  the  computing  power  available  within  a  national  intelligence  agency,  it  remains  a  question  as  to 
whether  such  an  approach  offers  much  help  to  the  less-experienced  military  analyst  or  planner  serving  within  a 
combatant  theater  of  operations. 

Statistical  Analysis  of  Insurgency  Trend  Data 

A  second  approach  taken  to  understanding  insurgency  movements  involves  the  statistical  analysis  of  terrorism 
incidents  and  counterinsurgency  trend  data.  An  illustration  of  the  first  type  of  analysis  can  be  seen  in  the  annual 
report  on  incidents  of  terrorism  published  by  the  US  National  Counterterrorism  Center5  and  the  corresponding  US 
database  on  terrorist  incidents  maintained  within  the  Worldwide  Incidents  Tracking  System.6  Within  this  database, 
one  can  develop  incident  statistics  organized  by  any  number  of  factors  such  as  geographic  location,  date,  perpetrator 
characteristics,  facility  characteristics,  damage  level,  and  type  of  attack.  Statistical  analyses  of  counterinsurgency 
trend  data  typically  broaden  the  types  of  information  considered;  however,  the  basic  approach  still  involves 
summarizing  different  types  of  state  variables  over  time.  An  example  of  this  approach  is  seen  in  the  Defense 
Department’s  annual  report  to  Congress  on  stability  and  security  operations  in  Iraq7  that  provides  a  summary  of 
various  political,  economic,  and  security  indicators  over  a  specific  time  period. 

As  noted  by  Richard  Hayes  et  al ,  measuring  terrorism  is  simple  whereas  measuring  the  progress  of  an  insurgency 
movement  is  more  complex.8  With  an  insurgency  movement,  there  typically  will  be  lots  of  relevant  data  available 
from  various  parties  involved  in  the  conflict  -with  each  attempting  to  create  a  positive  impression  of  their 
operational  status  and  progress.  There  will  also  be  many  different  interpretations  of  what  this  data  means. 
Consequently,  it  is  only  when  “the  issues  are  reduced  to  data  and  hypotheses  are  clearly  formulated  about  the 
trends  to  be  expected  in  the  data  can  we  hope  to  develop  a  realistic  understanding  of  what  is  occurring .”9  In  short, 
the  analysis  of  insurgency-relevant  state  variables  must  take  place  within  a  theoretical  context  in  order  for  each 
element  of  the  data  to  be  properly  interpreted  and  integrated  into  a  holistic  understanding.  Simple  trend  summaries 


2  Defense  Advanced  Research  Project  Agency.  (2003).  Report  to  Congress  Regarding  the  Terrorism  Information  Awareness  Program.  May  20, 
2003. 

3  Advanced  Research  and  Development  Activity  (2005).  “Novel  Intelligence”  webpage  retrieved  from  http://www.ic- 
arda.org/Novel_Intelligence/  on  11  August,  2005. 

4  Cowley,  P.;  Nowell,  L.;  &  Scholtz,  J.  (2005).  Glass  Box:  An  instrumented  infrastructure  for  supporting  human  interaction  with  information. 
Hawaii  International  Conference  on  Systems  Sciences ,  Jan  3-6,  2005. 

5  National  Counterterrorism  Center.  (2005).  Report  on  Incidents  of  Terrorism  2005.  1 1  April  2005. 

6  The  Worldwide  Incidents  Tracking  System  can  be  accessed  and  interactively  searched  at  http://wits.nctc.gov. 

7  Department  of  Defense.  (2006).  Measuring  Stability  and  Security  in  Iraq,  Report  to  Congress.  August  2006. 

8  Hayes,  R.E.;  Hayes,  M.D.;  Davis,  B.C.;  Keane,  S.Y.;  Kossakowski,  P.;  Leary,  A.E.;  Saenz,  A.  &  Tarter,  J.E.  (2005).  Measuring  terrorism  and 
insurgency  in  a  21st-century  context.  Proceedings  of  the  Cornwallis  Group  IX:  Analysis  for  Stabilization  and  Counter-Terrorist  Operations,  5-8 
April,  2004.  Stad  Shlaining,  Austria,  pp.  257-295. 
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and  statistics,  by  themselves,  will  yield  little  predictive  insight  regarding  the  true  status  and  progress  of  an 
insurgency  movement. 

Social  Network  Analysis  of  Terrorist  Groups 

A  third  approach  to  analyzing  insurgency  movements  is  reflected  in  various  studies  that  have  employed  social 
network  methods  to  identify  relevant  linkages  among  participants  in  such  a  movement.  The  method — related  to 
network  theory — attempts  to  mathematically  construct  a  network  of  nodes  and  ties  that  link  individuals  and 
organizations  in  socially  meaningful  ways.  Social  network  analysis  is  based  on  several  premises:  (1)  social 
networks  operate  on  many  different  levels;  (2)  they  play  a  critical  role  problem-solving;  and,  hence,  (3)  they  provide 
insight  into  how  organizations  achieve  their  goals.  For  example,  social  network  analysis  has  been  used  to  reconstruct 
the  terrorist  network  involved  in  the  9/1 1  attacks  on  New  York  and  Washington,  DC. 10  Using  this  method  to  analyze 
available  data  regarding  e-mail/telephone  contacts,  face-to-face  meetings,  and  funding  channels,  it  was  shown  that 
each  of  the  19  hijackers  involved  in  this  orchestrated  attack  were  socially  linked  within  two  steps  of  the  two  original 
suspects — Nawaf  Alhazmi  and  Khalid  Almihdhar — uncovered  prior  to  the  attack  in  2000.  This  same  study  also 
revealed  that  Mohammed  Atta  was  a  local  leader  of  this  al-Qaeda  cell. 

The  use  of  social  network  analysis  would  appear  to  be  a  natural  fit  with  insurgency  movements.  Kathleen 
Carley,  for  example,  claims  that  social  network  analysis  can  be  used  to  identify  both  the  structural  classification  and 
critical  nodes  associated  with  a  specific  terrorist  network. 1 1  The  argument  follows  that  this  knowledge  can  be  used 
to  attack  and  disrupt  information  flow  and  decision  making  within  a  network  -thus  destabilizing  its  operation  and 
diminishing  its  effectiveness.  In  a  later  study,  Carley  claims  an  even  more  powerful  approach — dynamic  network 
analysis — for  studying  terrorist  networks  through  the  use  of  agent-based  modeling.12  However,  as  noted  by  John 
Robb,  evidence  indicates  that  insurgency  networks  aren’t  susceptible  to  disruption  in  a  traditional  organization 
sense.13  Such  networks  tend  to  exhibit  certain  properties  that  violate  the  assumptions  of  social  network  theory.  First, 
they  are  redundant  in  terms  of  leadership.  Emergent  leaders  quickly  ascend  when  other  leaders  are  removed,  often 
through  pre-existing,  latent  connections  that  are  “turned  on”  as  needed.  Second,  they  are  composed  of  a  meta-matrix 
of  networks  for  information  transfer,  knowledge  sharing,  task  completion,  and  so  forth.  Third,  they  are  dynamic  in 
nature.  Relationships  within  an  insurgency  network  are  not  dictated  by  a  assigned  hierarchical  relationships.  Rather 
they  are  “ based  on  a  panoply  of  factors  that  are  constantly  changing.  Therefore,  the  structure  of  the  network  is  in 
constant  flux  in  response  to  learning  and  adaptation  by  the  individual  nodes.”14 

The  shortcomings  of  social  network  analysis  as  a  method  for  studying  insurgency  movements  reflect  an 
underlying  philosophical  disconnect.  Social  network  analysis  emphasizes  organizational  structure  over 
organizational  purpose  and  functioning.  That  is,  as  a  methodology,  it  begins  with  the  study  of  organizational 
structure  and  presumes  that  an  understanding  of  purpose  and  functioning  can  be  derived  from  an  identified  structure. 
Insurgency  movements,  however,  begin  with  a  purpose  and  establish  an  adaptive  functioning  over  time  to 
accomplish  that  purpose.  As  noted  by  Robb,  the  organizational  structure  of  an  insurgency  movement  can  contain 
latent  elements,  emergent  leadership,  and  adaptive  task  definition  -all  of  which  constantly  evolve  over  time  to 
accommodate  the  conditions  within  which  the  movement  must  operate.  Thus,  it  order  to  properly  study  an 
insurgency  movement,  one  must  begin  with  an  understanding  of  purpose  and  functioning  and,  only  then,  move 
toward  the  inference  and  verification  of  organizational  structure. 

Focused  Analysis  of  Insurgency  Characteristics 

A  fourth  approach  identified  in  the  literature  on  insurgency  analysis  can  be  described  as  a  collection  of  analyses 
that  focus  on  selected  aspects  of  an  insurgency  movement.  These  studies  address  a  range  of  topics  and  employ  a 
variety  of  analytical  and  qualitative  research  methods.  Their  common  feature  is  simply  that  they  serve  to  provide 
deeper  insight  into  a  particular  facet  or  characteristic  of  insurgency  movements.  For  example,  one  study  has 
compared  terrorist  cells  with  organized  crime  rings  in  an  attempt  to  determine  the  optimal  effective  group  size 


10  Krebs,  V.E.  (2002).  Mapping  networks  of  terrorist  cells.  Connections,  Volume  24(3).  pp.  43-52.  [retrieved  from 
http://www.insna.org/Connections-Web/Volume24-3/Valdis.Krebs.web.pdf  on  28  September,  2006.] 

11  Carley,  K.M.;  Lee,  J.  &  Krackhardt,  D.  (2002).  Destabilizing  networks.  Connections,  Volume  24(3).  pp.  79-92. 

12  Carley,  K.M.;  Dombroski,  M.;  Tsvetovat,  M.;  Reminga,  J.  &  Kamneva.  N.  (2003).  Destabilizing  dynamic  covert  networks.  Proceedings  of  the 
8th  International  Command  and  Control  Research  and  Technology  Symposium,  Washington,  DC.  Vienna,  VA:  Evidence  Based  Research.  Inc. 

13  Robb,  J.  (2004).  Destabilizing  terrorist  networks.  Global  Guerrillas,  22  March,  2004.  [Weblog  entry  retrieved  from 
http://globalguerrillas.typepad.com  on  24  September,  2006] 

14  Ibid. 


3 


(thought  to  be  between  five  and  twelve  members).15  In  a  study  of  suicide  terrorism,  Robert  Pape  found  that  recent 
increases  in  the  incidence  of  suicide  attacks  can  be  explained  as  a  logical  lesson  learned  from  past  insurgency 
movements.16  Quite  simply,  suicide  attacks  were  found  to  be  effective  in  coercing  target  nations  such  as  Lebanon, 
Israel,  and  Sri  Lanka  to  cede  territorial  control  to  different  insurgency  movements.  In  another  study  that  examined 
the  socio-psychological  profiles  of  modem  terrorists,  Rex  Hudson  found  that  there  exists  an  increasing  willingness 
of  religious  fundamentalist  groups  to  employ  weapons  of  mass  destmction  to  achieve  their  goals.17  In  addition,  this 
same  work  identified  specific  psychological  types  who  would  be  most  likely  to  use  or  threaten  the  use  of  weapons  of 
mass  destmction.  At  the  same  time,  there  is  an  increasing  tendency  of  these  groups  to  recmit  highly  trained 
individuals  from  the  fields  of  communications,  computer  programming,  engineering,  finance,  and  the  sciences. 
Whereas  the  elite  terrorist  commandos  of  the  1960s  and  1970s  were  limited  to  what  they  learned  in  training  camps, 
the  recmitment  of  individuals  who  reflect  both  religious  zealotry  and  technical  expertise  increases  the  likelihood  of 
highly  skilled  and  orchestrated  attacks  in  the  future.  In  a  more  recent  study  of  the  psychology  of  terrorism,  Jeff 
Victoroff  notes  that  much  of  the  published  work  in  this  area  is  theoretical — rather  than  empirical — in  nature.18  Thus, 
much  of  our  understanding  of  the  mind  of  the  terrorist  is  likely  to  be  based  on  flawed  premises.  In  response,  he 
argues  that  our  study  and  analysis  of  insurgency  movements  must  balance  both  theory  and  evidence  -or  more 
specifically,  that  “ the  best  solution  is  hypothesis-based  research  and  evidence-based  policies”19 

While  a  review  of  these  types  of  focused  studies  suggests  their  potential  utility  for  understanding  the  nature  and 
behavior  of  different  insurgency  movements,  they  do  not  provide  a  holistic  framework  for  predictive  analysis.  As 
noted  earlier  in  this  paper,  insurgency  movements  are  dynamically  shaped  by  a  panoply  of  factors.  Thus,  while  these 
analyses  might  offer  insight  into  a  specific  aspect  of  their  operation,  it  is  only  when  they  are  considered  in  the 
context  of  other  factors  that  one  can  begin  to  construct  a  realistic  understanding  of  an  insurgency  movement. 

Formal  Modeling  of  Insurgency  Movements 

A  final  approach  identified  in  the  literature  on  insurgency  analysis  involves  the  formal  modeling  of  insurgent 
group  behavior  and  decision  making.  The  term  “modeling”  covers  a  wide  range  of  analytical  approaches;  however, 
the  efforts  addressed  here  each  have  the  common  goal  of  predicting  the  behavior  of  specific  insurgency  movements. 
In  one  study  by  Ransom  Weaver  et  al ,  the  authors  illustrate  a  decision-theoretic  approach  to  modeling  different 
levels  of  a  decision  cycle  within  a  terrorist  organization  -e.g.,  create  an  organization,  plan  a  campaign,  select 
specific  missions,  plan  a  mission,  and  conduct  operations.20  Assuming  a  “rational  actor”  model  of  decision  making, 
they  illustrate  various  approaches — e.g.,  Markov  chains,  game  theory — for  modeling  course-of-action  decision 
choices  by  terrorist  groups.  In  another  study,  Jim  Doran  constructs  an  agent-based  model  of  guerrilla  warfare  to 
analytically  explore  the  effectiveness  of  specific  insurgency  tactics.21  As  a  potential  tool  for  guiding  cease-fire 
negotiations,  the  resulting  model  offers  predictive  insight  into  such  tactics  as  an  all-out  counterinsurgency  campaign 
by  government  forces  (e.g.,  the  so-called  “Salvador  option”)  or  a  hyper-mobile  strategy  by  insurgents  (e.g.,  the  use 
of  “flying  columns”  by  the  Irish  Republican  Army).  In  another  agent-based  modeling  study,  Michael  Findley  and 
Joseph  Young  delve  deeper  into  various  factors  characterizing  a  population’s  attitudes  toward  an  insurgency.22  Here, 
they  are  able  to  analytically  explore  the  interaction  of  (1)  attrition  policies  that  impose  costs  of  supporting  an 
insurgency  on  a  population  with  (2)  “winning  hearts  and  minds”  policies  that  provide  benefits  to  the  population.  A 
systems  dynamics  model  of  insurgency  movements  has  been  developed  by  Edward  Anderson  to  explore  the 
interaction  of  various  relevant  causal  loops  such  as  an  “insurgency  suppression”  loop,  an  “insurgency  creation”  loop, 
a  “foreign  war  effect”  loop,  and  a  “population  war  weariness”  loop.23  Testing  the  model  against  the  Anglo-Irish  War 


15  Robb,  J.  (2004).  The  optimal  size  of  a  terrorist  network.  Global  Guerrillas,  24  March  2004.  [Weblog  entry  retrieved  from 
http://globalguerrillas.typepad.com  on  24  September,  2006] 

16  Pape,  R.A.  (2005).  Dying  to  Win:  The  Strategic  Logic  of  Suicide  Terrorism.  New  York:  Random  House. 

17  Hudson,  R.A.  (1999).  The  Sociology  and  Psychology  of  Terrorism:  Who  Becomes  a  Terrorist  and  Why?  Washington,  DC:  Federal  Research 
Division,  Library  of  Congress. 

18  Victoroff,  J.  (2005).  The  mind  of  the  terrorist.  Journal  of  Conflict  Resolution.  Volume  49,  Number  1.  pp.  3-42. 

19  Ibid. 

20  Weaver,  R.;  Silverman,  B.G.;  Shin,  H.  &  Dubois,  R.  (2001).  Modeling  and  simulating  terrorist  decision-making:  A  “performance  moderator 
function”  approach  to  generating  virtual  opponents.  10th  Computer  Generated  Forces  Proceedings,  New  York:  SISO  &  IEEE.  May,  2001. 

21  Doran,  J.  (2006).  Modelling  a  typical  guerrilla  war.  Proceedings  of  the  IEEE  Workshop  on  Distributed  Intelligent  Systems:  Collective 
Intelligence  and  Its  Applications  (DIS’06),  15-16  June,  2006.  Prague,  Czech  Republic. 

22  Findley,  M.G.  &  Young,  J.K.  (2006).  Swatting  Flies  With  Pile  Drivers?  Modeling  Insurgency  and  Counterinsurgency.  Working  paper  retrieved 
from  http : // garnet . acns . fsu.edu/ ~j ky04/ s wattingflies .pdf 

on  29  Sept  06. 

23  Anderson,  E.G.  (2006).  A  preliminary  system  dynamics  model  of  insurgency  management:  The  Anglo-Irish  war  of  1916-21  as  a  case  study. 

The  24th  International  Conference  of  the  System  Dynamics  Society,  23-27  July,  2006.  Nijmegen,  The  Netherlands. 
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of  1916-21  case  study,  the  author  found  that  no  single  parameter  or  variable  is  likely  to  offer  a  sufficient  mechanism 
for  controlling  an  insurgency  movement.  Rather,  control  of  an  insurgency  movement  requires  “policies  that  create 
many  simultaneous,  synergistic  changes.”  Results  from  the  same  model  also  suggest  that  it  might  very  well  be 
impossible  to  completely  eliminate  an  insurgent  activity.  Rather,  even  the  best  combination  of  actions  will  merely 
reduce  it  to  an  acceptable  level.24 

More  general  writings  on  the  modeling  of  insurgency  movements  can  also  be  found  in  the  current  literature. 
These  papers  offer  insight  into  the  proper  framing  of  analytical  issues,  but  have  not  yet  transformed  these  ideas  into 
a  specific  computational  model.  For  example,  several  papers  by  Thomas  Hammes  have  provided  a  framework  for 
understanding  the  political  underpinnings  and  evolving  tactics  employed  by  insurgency  movements  over  the  past 
several  decades.2526  Insurgency  movements  are  characterized  as  “fourth  generation  warfare,”  in  contrast  to  previous 
generational  models  of  military  conflict.27  Tracing  the  evolution  of  insurgency  movements  from  Mao  Tse-Tung  to 
Afghanistan  and  Iraq,  Hammes  concludes  that  insurgency  movements  often  involve  a  loose  coalition  of  the  willing 
on  the  anti-government  side  who  are  prepared  to  employ  a  variety  of  low-intensity  military,  economic,  social,  and 
information  methods  and  networks  to  (1)  shape  what  a  society  thinks  about  itself  and  the  world  and  (2)  influence  the 
minds  of  government  policy  makers.  Insurgency  campaigns  are  waged  at  several  levels — national,  international, 
transnational,  and  subnational — over  time  to  achieve  the  long-range  goals  of  change.  In  response,  we  must  develop 
more  agile  and  comprehensive  ways  of  dealing  with  insurgency  movements  rather  than  assuming  that  they  can  be 
forced  into  a  conventional  type  of  high-technology,  maneuver  warfare.  As  noted  by  Hammes,  “Rather  than  seeking 
better  ways  to  fight  the  conventional  wars  we  already  dominate,  we  must  find  better  ways  to  fight  the  kinds  of  wars 
we  lose  — fourth-generation  wars .”28 

In  another  paper  that  explores  recent  counterinsurgency  operations  in  the  Republic  of  the  Philippines  and 
Operation  Iraqi  Freedom  II,  Eric  Wendt  more  formally  introduces  a  number  of  theoretical  models  that  can  be  used  to 
guide  strategic  planning.29  An  “area  of  influence”  model  focuses  attention  on  the  fundamental  issue  of  moving  a 
population’s  support  away  from  an  insurgency  movement  and  toward  the  government  through  a  mixture  of  “stick 
and  carrot”  methods.  An  “insurgency  support  and  flow”  model  identifies  key  elements  of  a  region’s  infrastructure 
supporting  an  insurgency  movement.  This  model  recognizes  the  principle  that  there  typically  exist  ten  sympathizers 
within  a  civilian  population  for  every  member  of  an  insurgency  movement.  An  “equivalent  response”  model 
identifies  the  narrow  band  of  effective  response  options  that  can  be  taken  against  an  insurgency  movement.  Too 
much  proportionate  violence  or  control  only  serves  to  alienate  the  population,  whereas  too  little  violence  or  control 
leads  to  the  impression  that  the  government  is  powerless  or  ineffectual.  A  “diamond  insurgent  /  counterinsurgent 
model”  model  illustrates  the  various  lines  of  operation  competitively  used  by  the  government  and  insurgency 
movement  to  influence  the  internal  population  and  international  actors.  A  final  “military  component”  model 
illustrates  the  coordinated  use  of  constabulary  forces,  quick  reaction  infantry  forces,  and  maneuver-to-contact  forces 
for  isolating  and  defeating  the  military  elements  of  an  insurgency  movement. 

The  theoretical  frameworks — or  models — offered  by  Hammes  and  Wendt  are  not  yet  in  an  analytic  form  that 
can  assist  in  the  detailed  analysis  and  assessment  of  a  specific  insurgency  movement.  Yet,  they  each  provide  useful 
ways  of  thinking  about  the  essential  elements  of  an  insurgency  movement.  Like  any  good  theoretical  model,  they 
serve  to  focus  attention  on  what  is  important  or  critical  to  our  understanding  of  a  problem.  As  such,  they  provide 
guidance  for  developing  future  tools  that  can  help  intelligence  analysts  and  military  planners  in  identifying, 
isolating,  interpreting,  and  targeting  the  critical  elements  of  an  insurgency  movement. 

Deficiencies  of  Existing  Approaches 

A  review  of  existing  analytical  approaches  to  understanding  the  nature  and  status  of  an  insurgency  movement 
reveals  a  number  of  deficiencies.  For  example,  automated  search  algorithms  for  mining  massive  quantities  of  open 
source  literature  rely  upon  the  tacit  expertise  of  the  analyst  to  frame  or  guide  what  is  otherwise  a  serendipitous 
process  of  trial  and  discovery  of  relevant  knowledge  elements.  Statistical  analysis  of  insurgency-relevant  state 
variables  focuses  on  past  or  current  events  that,  without  placement  within  the  context  of  informed  hypotheses,  are 


24  Ibid. 

25  Hammes,  T.X.  (1994).  The  evolution  of  war:  The  fourth  generation.  Marine  Corps  Gazette ,  September  1994.  pp.  35-44. 

26  Hammes,  T.X.  (2004).  4th-generation  warfare:  Our  enemies  play  to  their  strengths.  Armed  Forces  Journal ,  November,  2004.  pp.  40-44. 

27  The  first  generation  of  modem  war  was  dominated  by  massed  manpower  and  culminated  in  the  Napoleonic  Wars.  The  second  generation  was 
dominated  by  firepower  and  ended  in  World  War  I.  During  World  War  II,  the  Germans  introduced  third-generation  warfare,  characterized  by 
maneuver.  That  type  of  combat  is  still  largely  the  focus  of  U.S.  military  forces. 

28  Ibid. 

29  Wendt,  E.P.  (2005).  Strategic  counterinsurgency  modeling.  Special  Warfare ,  September,  2005.  p.  2-13. 
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unlikely  to  yield  predictive  insight.  Social  network  analysis,  which  attempts  to  model  a  fixed  organizational 
structure  rather  than  focusing  on  purpose  and  functioning,  fails  to  address  the  dynamic  and  emergent  nature  of 
insurgency  movements.  Studies  that  focus  on  a  specific  aspect  of  an  insurgency  movement — e.g.,  their  recruitment 
of  specific  types  of  individuals — offer  limited  insight,  but  they  do  not  provide  a  holistic  framework  for  predictive 
analysis.  Finally,  a  number  of  theoretical  modeling  efforts  offer  a  useful  framing  of  issues;  however,  these 
frameworks  require  additional  development  in  order  to  be  useful  as  an  analytical  tool. 

At  a  more  fundamental  level,  existing  methods  of  analysis  fail  in  two  respects.  First,  as  suggested  in  the 
preceding  paragraph,  they  fail  to  incorporate  strategic  thinking  into  their  analytical  framework.  Searching  for 
surface-level  bits  and  pieces  of  an  insurgency  movement  places  focus  on  their  immediate  tactical  details  while 
ignoring  the  grand  strategy  inherent  in  most  insurgency  campaigns.  Counterinsurgency  operations  based  on  such 
intelligence  analysis  is  thus  likely  to  reflect  a  “whack-a-mole”  policy  of  responding  to  individual  attacks  and 
localized  combat  initiatives  while  failing  to  deal  with  the  more  fundamental  aspects  of  a  long-term  insurgency 
campaign.  Second,  such  methods  of  intelligence  analysis  are  not  integrated  with  the  operational  planning  process 
that  ultimately  uses  their  products  and  findings.  As  noted  by  the  Air  Force  Scientific  Advisory  Board  in  a  2002 
assessment,  predictive  battlespace  awareness  (PBA)  requires  a  cultural  change  that  will  enable  air  and  space 
commanders  to  anticipate,  pre-empt,  influence,  and  decisively  defeat  their  adversaries.  Specifically,  “PBA  is  not  an 
intelligence  product  or  service  that  is  handed  to  the  commander.  Rather,  PBA  is  a  commander-driven,  pre-crisis 
predictive  process  that  must  transition  seamlessly  from  the  strategic,  to  the  operational,  to  the  tactical  level  of 
war.”30  More  recently,  Piccerillo  and  Brumbaugh  have  noted  that  traditional  intelligence  assets  and  processes  are  not 
postured  to  effectively  support  effects  based  operations. 31  Specifically  citing  experience  in  Afghanistan  and  Iraq, 
they  argue  that  reconnaissance,  surveillance,  and  intelligence  operations  should  be  employed  for  confirmation  rather 
than  discovery  type  missions  -i.e.,  missions  based  on  an  anticipatory  understanding  of  an  insurgency’s  campaign 
plan.  It  follows  that  an  operational  planning  framework  provides  an  appropriate  structure  for  building  an 
understanding  of  an  insurgency  movement  -one  that  specifically  addresses  the  components  of  an  insurgency 
campaign  and  how  the  Joint  force  commander’s  counterinsurgency  operations  can  be  tailored  to  defeat  this 
campaign.  Here,  existing  military  doctrine  provides  a  number  of  frameworks — most  notably,  the  “elements  of 
operational  design” — that  can  be  applied  in  reverse  to  the  analysis  of  an  insurgency  campaign  in  order  to  identify 
critical  elements  and  their  referent  linkages  within  an  overall  understanding. 

A  Work-Centered  Approach 

To  remedy  these  deficiencies,  Evidence  Based  Research,  Inc.  (EBR)  has  undertaken  the  prototype  development 
of  an  analytical  tool  suite  that  reflects  a  work-centered  approach  to  understanding  the  nature  and  status  of  an 
insurgency  movement.  Initiated  with  funding  support  and  technical  guidance  from  the  US  Air  Force  Research 
Laboratory’s  Human  Effectiveness  Directorate,  this  approach  is  based  on  the  concept  of  developing  and  organizing 
this  understanding  within  the  framework  of  an  insurgency  movement’s  work  control  structure.  In  this  regard,  the 
approach  draws  heavily  upon  past  research  that  addresses  how  organizations  (such  as  an  insurgency  movement)  link 
high-level  intent  with  tactical  level  action  through  the  development  of  a  work  control  structure.  This  understanding 
is  augmented  by  military  planning  doctrine  that  historically  identifies  the  nature  and  structure  of  a  military 
campaign.  Together,  these  understandings  guide  the  development  of  an  epistemological  framework  for  assembling 
and  interpreting  available  intelligence  information  into  a  cohesive  picture  of  an  insurgency  campaign  -one  that  can 
be  used  to  guide  Joint  military  planners  in  identifying  appropriate  targets  and  actions  to  defeat  an  insurgency 
movement.  As  such,  this  framework  is  specifically  matched  with  the  natural  tendency  of  human  analysts  and 
decision  makers  to  (1)  mentally  shape  their  understanding  of  an  operational  situation  in  story  form  and  (2) 
instantiate  that  understanding  to  a  workable  level  of  certainty  on  the  basis  of  available  observations. 

Analytic  Strategy 

The  work-centered  campaign  analysis  approach  responds  to  two  basic  needs  of  the  analyst  who  is  faced  with 
multiple  streams  of  insurgency-related  events  within  a  theater  of  operation:  (1)  reduce  order  (ambiguity  and 
equivocality)  to  provide  a  coherent  explanation  of  a  complex  and  evolving  situation  and  (2)  instantiate  beliefs  to  a 
workable  level  of  certainty.  Accordingly,  the  analytic  strategy  provides  the  following  functionality: 


30  US  Air  Force  Scientific  Advisory  Board.  (2002).  Report  on  Predictive  Battlespace  Awareness  to  Improve  Military  Effectiveness,  Volume  1: 
Summary ,  SAB-TR-02-01.  July  2002.  p.  vi. 

31  Piccerillo,  R.A.  &  Brumbaugh,  D.A.  (2004).  Predictive  battlespace  awareness:  Linking  intelligence,  surveillance,  and  reconnaissance 
operations  to  effects  based  operations.  2004  Command  and  Control  Research  and  Technology  Symposium ,  San  Diego,  CA,  15-17  June,  2004. 
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•  Incrementally  build  understanding  in  a  “ top  down  ”  and  “ bottom  up  ”  manner  simultaneously ,  so  as  to 
construct  and  maintain  a  feasible  story  regarding  an  insurgency  campaign’s  lines  of  operation  and  tactical 
actions; 

•  Stories  are  epistemologically  framed  by  a  work  control  structure  that  coherently  connects  an  insurgency’s 
intent  with  its  capabilities  and  provides  a  cause/effect  context  for  explaining  observed  and  predicted  events 
and  conditions; 

•  Incorporate  multiple  perspectives ,  so  as  appreciate  the  breadth  and  complexity  of  the  operational  and 
tactical  problem  space  impacted  by  the  insurgency  campaign; 

•  Construct  situational  meaning  of  observed  events  and  conditions  as  a  function  of  their  negotiated 
placement  within  an  overall  story  -i.e.,  understanding  is  autopoietic  in  nature;  and 

•  Treat  beliefs  as  nonper sis  tent,  situation-dependent  propositions ,  not  static,  universal  truths  —i.e.,  beliefs 
will  change  in  relation  to  the  emergent  and  opportunistic  strategies  and  tactics  of  the  insurgency  movement 

In  order  to  implement  this  strategy,  we  adopt  a  constructivist  or  sensemaking  philosophy  by  defining  data, 
information,  situation  awareness,  and  situation  understanding  in  the  following  manner: 

•  Data  -  a  collection  of  numbers,  words,  images,  or  other  symbols  that  symbolically  represent  bracketed 
artifacts  of  a  situation.  Bracketed  artifacts  reflect  observed  facts  or  abstracted  assertions  that  are  singled  out 
for  attention  based  on  their  perceived  relevance  to  a  work  system’s  constructed  problem  space. 

•  Information  -  a  collection  of  bracketed  artifacts  that  specifically  reduce  uncertainty  in  a  holistic  framework 
of  situation  awareness  and  understanding  of  a  work  system’s  constructed  problem  space. 

•  Situation  Awareness  -  the  bracketing  of  specific  artifacts  within  an  operational  environment,  based  on  their 
relevance  to  a  work  system’s  constructed  problem  space. 

•  Situation  Understanding  -  the  functional  association  of  these  bracketed  artifacts  in  a  way  that  links  intent 
with  capability  to  give  meaning  to  effects  and  actions  within  a  work  system’s  constructed  problem  space. 

Together,  these  epistemological  elements  form  a  self-referent  and  holistic  picture  of  an  insurgence  campaign  as 
it  evolves  over  time. 

Work  Control  Structure:  A  Framework  of  Instantiated  Beliefs 

The  analysis  of  an  insurgency  campaign  is  framed  by  an  epistemological  structure  we  call  a  “Work  Control 
Structure ,”  an  analytical  construct  that  reflects  an  extension  of  earlier  work  by  Jens  Rasmussen32  and  its  consistent 
with  the  data/frame  model  of  sensemaking  proposed  by  Gary  Klein33 .  A  work  control  structure  reflects  an 
organization’s  open-ended  referent  knowledge  structure  for  linking  intent  with  action  and  accomplishing  purposeful 
work.  It  provides  a  socio-cognitive  framework  within  which  to  organize  available  information,  tacit  expertise,  and 
organizational  recipes  in  a  relevant  manner,  to  develop  both  awareness  and  understanding  of  the  operational 
environment,  and  to  plan  and  execute  goal-related  actions  that  move  the  organization  toward  a  desired  endstate.  A 
work  control  structure  can  be  seen  as  an  achieved  state  of  knowledge  that  is  constructed,  negotiated,  and 
dynamically  maintained  by  many  different  people  working  together  throughout  the  organization.  Typically,  no 
individual  has  complete  knowledge  of  and  control  over  an  organization’s  work  control  structure  in  its  entirety. 
Rather,  different  individuals  and  communities  of  interest  collaborate  to  integrate  the  levels  of  thinking  illustrated  in 
Figure  1. 

Normally,  an  organization  develops  and  maintains  its  work  control  structure  over  time  through  its  planning  and 
execution  process.  In  the  current  project,  we  apply  the  concept  of  a  work  control  structure  in  a  reverse  engineering 
manner,  based  on  intelligence  analyses  and  a  stream  of  on-going  behavioral  observations  from  the  theater  of 
operation.  For  example,  the  top  four  levels  of  the  work  control  structure  for  an  insurgency  campaign  under  study  can 
be  developed  from  regional  studies  and  assessments.  Similarly,  the  bottom  level  (work  system  capabilities)  can  be 
developed  from  these  same  documents.  However,  the  elements  comprising  these  levels  represent  a  more  abstract 
understanding  of  an  insurgency  campaign  -i.e.,  they  represent  a  linked  set  of  working  hypotheses  that,  over  time, 
will  evolve  according  to  the  adaptive  nature  of  insurgency  movements.  Thus,  these  beliefs  must  be  instantiated 


32  Rasmussen,  J.;  Pejtersen,  A.M.  and  Schmidt,  K.  (1990).  Taxonomy  for  Cognitive  Work  Analysis .  Roskilde,  Denmark:  Ris0  National 
Laboratory. 

33  Klein,  G.;  Phillips,  J.K.;  Rail,  E.L.  &  Peluso,  D.A.  (2007).  A  data/frame  theory  of  sensemaking.  In  R.R.  Hoffman  (ed.)  Expertise  Out  of 
Context:  Proceedings  of  the  6th  International  Conference  on  Naturalistic  Decision  Making.  Mahwah,  NJ:  Erlbaum. 
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(given  evidentiary  support)  through  the  analysis  of  on-going  events  and  actions  observed  to  be  taken  by  the 
insurgency  movement. 
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Work  System  Capabilities 

The  work  potential  maintained  within  the  work 
system  in  terms  of  specific  capabilities  and 
resources 


KNOWLEDGE  ELEMENTS 


Cfl  CZI 


■  Association 


d  a  d 

•  % 


i^c^t^i^i^c^i^c^i±icpc±icpc±i 

•  i  *  a  *  i  /  •  /  *  /  »  / 

1/  it  ■#  •#  »r 

tit  v  ^  u  u  *i 

pcppQaa 
\  :  \  ;  \  / 

□ 


Figure  1  Work  Control  Structure 

The  middle  three  levels  of  the  work  control  structure  (key  objects/events/conditions,  targeted  actions  and 
timing,  and  committed  resources)  represent  the  more  concrete  and  observable  elements  of  an  insurgency  campaign. 
Unlike  the  more  abstract  levels  within  the  work  control  structure,  these  levels  can  be  directly  instantiated  through 
behavioral  observations  from  the  theater  of  operation.  As  intelligence  reports  and  open-source  news  items  are 
received,  they  can  be  gleaned  to  document  specific  instances  where  the  insurgency  movement  has  committed 
resources  to  execute  an  action  against  a  key  object  ( e.g .,  political  figure,  neighborhood,  military  unit,  facility),  event 
( e.g .,  street  protest,  parliamentary  election,  government  operation),  or  condition  (e.g.,  political  unrest, 
disenfranchised  population).  As  these  behavioral  observations  are  accumulated,  they  can  be  functionally  associated 
upward  with  specific  system  influence  pathway  hypotheses  and  used  to  provide  either  supportive  or  contradictory 
evidence  for  these  hypotheses.  Computationally,  Bayesian  analysis  can  be  employed  to  provide  continual  updating 
of  an  “evidentiary  strength”  for  each  system  influence  pathway  hypothesis,  based  on  an  incoming  stream  of 
behavioral  observations.  Through  a  system  of  analyst-assigned  weighting  factors,  evidentiary  strengths  can  be 
propagated  upward  from  system  influence  pathways  to  compute  a  belief  strength  for  each  operational  focus. 
Likewise,  these  same  observations  can  be  organizationally  associated  downward  with  hypothesized  work  system 
capabilities  to  instantiate  the  relative  power  and  influence  of  different  parts  of  the  insurgency  movement’s 
organization. 


Story  Lines:  A  Natural  Framework  for  Framing  Understanding 

Over  time,  as  the  analyst  builds  and  maintains  this  linked  set  of  hypotheses  and  behavioral  observations,  story 
lines  begin  to  emerge  that  provide  high  levels  planners  and  decision  makers  with  a  more  holistic  picture  of  an 
insurgency  campaign.  As  seen  in  Figure  2,  a  story  line  reflects  a  linked  set  of  instantiated  beliefs  that  combine  intent 
with  capability  to  explain  a  specific  set  of  observations  over  time.  Thus,  a  completed  story  line  represents  a  vertical 
set  of  associations  that  (1)  extend  from  the  operational  focus  and  desired  endstates  of  an  insurgency  campaign,  (2) 
continue  downward  through  an  instantiating  set  of  behavioral  observations  (key  objects,  targeted  actions,  committed 
resources),  and  (3)  connect  with  work  capabilities  reflected  in  the  current  organizational  structure  of  the  insurgency 
movement.  Once  developed,  each  story  line  can  be  used  to 

•  Identify  areas  of  ambiguity  and  uncertainty  that  drive  future  intelligence  collection, 

•  Assess  the  relative  progress  of  an  insurgency  campaign  along  a  specific  line  of  operation,  and 
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Predict  future  actions  that  an  insurgency  movement  might  take  to  further  its  progress  along  a  specific  line 
of  operation. 


Figure  2  Emergence  of  Story  Line  within  a  Work  Control  Structure 


Implementing  Architecture 

The  software  architecture  currently  implementing  a  prototype  of  this  approach  is  organized  around  five 
functional  modules  that  operate  against  an  analytic  backplane.  Each  of  the  five  modules  reflects  a  specific  step  in  the 
analyst’  sensemaking  process,  while  the  analytic  backplane  maintains  a  current  state  of  the  belief  structure  emerging 
from  these  processes.  As  shown  in  Figure  3,  the  modules  can  be  employed  in  an  iterative  sequence  as  the  analysts 
move  back  and  forth  between  maintaining  a  set  of  hypothesized  beliefs  and  instantiating  these  beliefs  with  real- 
world  observations.  Depending  upon  the  specific  nature  of  the  insurgency  campaign  and  the  availability  of 
supporting  intelligence,  story  lines  can  emerge  in  either  a  top-down  or  bottom-up  fashion  since  the  work  control 
structure  represents  a  self-referent  epistemological  framework.  The  flexibility  of  this  approach  corresponds  to  the 
natural  sensemaking  strategies  of  human  decision  makers.  At  the  same  time,  it  avoids  the  computational  pitfalls 
associated  with  knowledge  management  projects  that  reflect  more  of  a  logical  positivist  approach  -i.e.,  fixed 
ontologies  of  meaning,  rigid  propositional  logic. 

Analytic  Backplane 

The  analytic  backplane  maintains  the  current  state  of  a  hierarchically  linked  belief  elements  that  allow  the 
analyst  to  build  a  story-like  understanding  of  the  insurgency  campaign.  The  data  elements  comprising  this  backplane 
tie  together  the  different  analyst  modules  incorporated  into  the  analysis  tool. 

Module  1  -  Build  High-Level  Intentionally  Beliefs 

Module  1  allows  the  analyst  to  construct  and  maintain  the  top  three  levels  of  the  work  structure.  The  analyst 
populates  belief  elements  to  the  backplane  via  a  dialog  window  that  opens  within  a  graphical  database  manager.  The 
graphical  database  manager  then  allows  the  analyst  to  view  a  graphical  map  of  the  resulting  network  of  beliefs.  As 
beliefs  are  added  to  the  structure,  they  are  hyperlinked  to  supporting  intelligence  data,  regional  analyses,  and 
historical  analogies. 
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Figure  3  Insurgency  Campaign  Analysis  Tool  Architecture 


Module  2  -  Instantiate  High-Level  Beliefs  with  Evidence 

Module  2  enables  the  analyst  to  perform  each  of  two  analytical  tasks.  The  first  task  allows  the  analyst  to  enter  a 
stream  of  intelligence  reports  in  the  form  of  triads  that  each  include  a  key  object/event/condition  uniquely  paired 
with  an  action  and  a  committed  resource.  This  task  also  allows  the  analyst  to  modify  existing  triads.  As 
“object/action/resource”  triads  are  constructed,  they  are  hyperlinked  to  reference  documents  that  contain  supporting 
intelligence  data  -e.g.,  news  reports,  speeches,  informant  interviews.  The  second  task  allows  the  analyst  to  specify  a 
set  of  triads  to  be  associated  with  each  influence  pathway.  The  analyst  specifies  an  evidence  ratio  and  a  contribution 
weight  for  each  triad  as  it  is  associated  with  a  specific  influence  pathway.  The  resulting  evidence  strengths  for  each 
pathway  are  then  computed  by  applying  the  Bayesian  formula  to  its  associated  set  of  triads.  Current  evidence 
strengths  are  posted  to  the  graphical  database  display. 

Module  3  -  Conduct  Pattern  /  Consistency  Analysis 

Module  3  enables  the  analyst  to  perform  each  of  several  analytical  tasks.  The  first  task  allows  the  analyst  view 
the  resulting  belief  strengths  for  the  framework  of  high-level  intentionality  beliefs  in  levels  1-3  of  the  work  control 
structure.  Belief  strengths  for  each  of  the  operational  foci  are  computed  using  a  weighted  Euclidean  distance  formula 
applied  to  its  children  elements.  The  second  task  allows  the  analyst  to  conduct  a  pair-wise  morphological  analysis  on 
the  constructed  set  of  triads  to  indicate  where  the  insurgency  has  shifted  tactics.  The  third  task  allows  the  analyst  to 
develop  and  interpret  a  multidimensional  scaling  solution  for  the  set  of  triads  -i.e.,  clustered  triads  enable  dynamic 
redefinition  of  system  influence  pathways. 

Module  4  -  Build  High-Level  Capability  Beliefs 

Module  4  enables  the  analyst  to  construct  and  maintain  level  8  of  the  work  control  structure.  In  the  first  task,  the 
analyst  adds  belief  elements  to  the  backplane  via  a  dialog  window.  The  analyst  uses  graphical  database  manager  to 
graphically  view  the  current  state  of  the  structure.  Work  system  capabilities  in  level  8  are  hypothesized  on  the  basis 
of  historical  principles  of  insurgency  and  regional  analysis.  As  belief  elements  (work  system  capabilities)  are 
constructed,  they  are  hyperlinked  to  reference  documents  that  contain  supporting  intelligence  data,  regional  analysis, 
and  historical  analogies.  Module  4  also  allows  the  analyst  to  develop  and  interpret  a  second  type  of 
multidimensional  scaling  solution  for  the  set  of  triads  -i.e.,  clustered  triads  enable  identification  of  underlying  work 
system  capabilities.  The  analyst  can  then  populate  the  work  control  structure  with  these  identified  work  system 
capabilities. 
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Module  5  -  Construct  Story  Lines 

As  the  four  analytical  modules  are  iteratively  applied  to  build  the  work  control  structure,  the  analyst  is  able  to 
see  story  lines  emerging  from  the  graphical  structure  displayed  by  the  graphical  database  manager.  Story  lines 
represent  a  vertical  set  of  belief  element  associations  that  link  intent  and  capability  to  explain  and  predict  a  pattern  of 
purposeful  behavior.  As  shown  in  Figure  4,  story  lines  are  constructed  around  hypothesized  lines  of  operation. 

Triads  are  graphically  displayed  along  a  temporal  scale  and  compared  with  key  progress  milestones  to  define  the 
history  and  current  state  of  the  insurgency  campaign. 

Prototype  Implementation 

A  fully  functional  proof-of-principle  prototype  has  been  implemented  using  commercial  off-the-shelf  software. 
Mindjet  Min dManager®  Version  6  provides  the  graphical  database  management  and  visualization  capability,  with 
the  computational  aspects  of  the  tool  executed  in  Microsoft  Excel®  and  SPSS  for  Windows.  An  extensive  array  of 
Visual  Basic  add-ins  provide  for  user  dialog  windows  and  integration  of  the  various  software  packages.  The  entire 
tool  suite  runs  on  a  standard  desktop  computer  running  the  Windows  XP  operating  system. 

Brief  Illustration 

Discussion  of  the  project’s  actual  case  study  undertaken  with  a  real-world  insurgency  movement  is  beyond  the 
scope  and  level  of  detail  of  this  paper.  Instead,  the  following  hypothetical  example  briefly  illustrates  the  potential 
complexity  that  can  be  handled  by  the  campaign  analysis  tool.  In  this  example,  the  XYZ  Insurgency  Movement 
represents  a  religious  minority  group  that  is  attempting  to  gain  political  power  and  transform  a  pro-Western  country 
into  a  theocratic  republic.  The  movement  draws  its  support  from  three  sources:  (1)  the  religious  minority  population 
within  the  country,  (2)  a  neighboring  republic  that  is  sympathetic  to  overthrowing  the  country’s  existing  pro- 
Western  government,  and  (3)  a  scattered  diaspora  of  the  minority  population  located  in  various  communities  around 
the  world.  As  seen  in  Figure  4,  the  movement  has  developed  a  long-term  insurgency  campaign  around  three  desired 
end  states:  (1)  the  removal  of  Western  imperialism  from  the  country,  (2)  the  replacement  of  the  existing  pro-Western 
government  with  a  theocratic  republic,  and  (3)  the  recognition  and  acceptance  of  the  movement  as  a  legitimate 
representative  of  the  civilian  population  within  the  country.  Reflected  in  these  desired  endstates  are  three 
corresponding  centers  of  gravity  or  points  of  operation  focus  around  which  its  campaign  is  hypothesized  to  be 
organized. 


Operational  Focus  &  System  Influence  Pathways 


Cause/Effect  Connections  ? 


Organizational  Work  System  Capabilities 


XYZ 

Resistance 

Movement 


Figure  4  Fictional  Insurgency  Campaign:  High-Level  Intent  and  Work  System  Capabilities 
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From  historical  analyses  of  the  region  and  comparison  of  the  XYZ  Resistance  Movement  with  past  insurgency 
movements,  it  is  further  hypothesized  that  its  campaign  is  attempting  to  gain  progress  through  the  eight  system 
influence  pathways  shown  in  Figure  4.  Each  pathway  is  described  in  terms  of  a  desired  effect  to  be  achieved  by  the 
resistance  movement  and  a  targeted  set  of  obstacles  and  opportunities: 

•  Western  Corporations  and  Schools :  Removal  of  Western-owned  business  corporations  that  are 
monopolizing  the  country’s  economy  and  Western- sponsored  institutions  of  higher  learning  that  are 
fostering  an  anti-religious  secular  culture  within  the  country. 

•  Multinational  Intervention :  Persuasion  of  the  United  Nations  Security  Council  that  military  intervention 
within  the  country  by  a  coalition  of  Western  nations  is  unnecessary  to  bring  order  and  stability  to  the 
country. 

•  Parliamentary  System :  Political  domination  of  the  country’s  parliamentary  form  of  government  that  results 
in  the  resignation  of  the  existing  pro-Western  prime  minister  and  the  replacement  of  this  government  with  a 
radical  coalition  led  by  the  XYZ  Resistance  Movement. 

•  Majority  Population  A:  Political  co-option  of  the  country’s  secular  majority  population  that  results  in  its 
acceptance  of  the  XYZ  Resistance  Movement’s  radical  coalition  as  being  in  the  best  interests  of  national 
sovereignty. 

•  Minority  Population  B :  Political  co-option  of  the  country’s  other  religious  minority  population  that  results 
in  its  acceptance  of  the  XYZ  Resistance  Movement  as  a  legitimate  representative  of  its  economic  and  social 
interests. 

•  Minority  Population  C :  Development  of  strong  support  for  the  XYZ  Resistance  Movement  as  its  ethnic 
identity  and  leader,  including  continued  financial  support  and  recruitment  of  resistance  members  from  this 
population. 

•  Supporting  Country  Orange :  Continued  economic  and  military  weapons  support  for  the  XYZ  Resistance 
Movement,  and  endorsement  of  the  XYZ  Resistance  Movement  as  an  essential  partner  in  a  broader  struggle 
to  develop  a  pan-theocratic  region  in  this  part  of  the  world. 

•  Population  C  Diaspora :  Continued  economic  and  political  support  for  the  XYZ  Resistance  Movement’s 
health,  social  services,  and  reconstruction  initiatives  through  an  international  network  of  charitable 
organizations  and  business  cartels. 

Shown  at  the  bottom  of  Figure  4  are  a  set  of  work  system  capabilities  hypothesized  to  correspond  to  the  current 
(but  evolving)  organizational  structure  of  the  XYZ  Resistance  Movement.  Like  the  pathways  of  influence,  these 
capabilities  would  be  derived  from  current  intelligence  summaries.  They  include 

•  Resistance  Militia :  The  conventional  army  wing  of  the  XYZ  Resistance  Movement  comprised  of  basic 
recruits  and  technical  specialists  that  defend  Minority  Population  C  neighborhoods  and  carry  out  actions 
designed  to  intimidate  key  elements  of  the  existing  government  and  pro-Western  interests  within  the 
country. 

•  Internal  Security :  The  highly  covert  special  forces  wing  of  the  XYZ  Resistance  Movement,  comprised  of 
loyal  followers,  that  maintains  internal  discipline  and  organizes  political  protest  events. 

•  Training  and  Indoctrination :  A  special  unit  attached  to  the  militia  that  transforms  civilian  recruits  into 
various  military  specialists  and  provides  political  indoctrination  into  the  movement’s  system  of  religious 
discipline. 

•  Health  and  Social  Services :  A  publicly  visible  element  of  the  XYZ  Resistance  Movement  that  provides 
community  health  care  and  medical  services  to  neighborhoods  primarily  indwelled  by  Minority  Population 
C,  but  extending  to  include  Minority  Population  B  (takes  the  place  of  services  that  cannot  be  provided  by 
the  existing  government). 

•  Economic  Reconstruction :  A  publicly  visible  element  of  the  XYZ  Resistance  Movement  that  provides 
economic  reconstruction  and  vocational  training  for  Minority  Population  C  neighborhoods. 

•  Family  and  Martyr  Support :  A  publicly  visible  element  of  the  XYZ  Resistance  Movement  that  provides 
economic  support  the  widows  and  children  of  martyrs  who  have  died  in  suicide  attacks  executed  on  behalf 
of  the  resistance  movement. 
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•  Media  and  Propaganda :  A  network  of  TV,  radio,  and  news  service  organizations  that  provide  coverage  of 
on-going  events  and  conditions  within  the  country  from  the  political  perspective  of  the  XYZ  Resistance 
Movement. 

•  Political  Coalition :  A  political  alliance  comprised  of  the  XYZ  Resistance  Movement  and  other  minority 
political  parties  that  back  a  list  of  parliamentary  seat  holders  and  push  for  the  reformation  and/or 
resignation  of  the  existing  pro-Western  government. 

•  Foreign  Relations :  The  XYZ  Resistance  Movement’s  formal  relations  with  sympathetic  nations  that 
provide  a  degree  of  legitimacy  and  acceptance  of  the  movement  within  the  world’s  diplomatic  community. 

The  upper  and  lower  levels  of  belief  elements  within  the  work  control  structure  represent  a  set  of  hypotheses 
that  must  be  instantiated  and  given  evidentiary  support  through  concrete  events.  Thus,  the  challenge  illustrated  in  the 
middle  of  Figure  4  is  for  the  analyst  to  identify  and  develop  cause-effect  connections  that  link  the  set  of  work  system 
capabilities  to  the  set  of  system  influence  pathways.  As  these  connections  are  formed  and  strengthened,  story  lines 
begin  to  emerge  as  explanations  and  progress  assessments  of  the  overall  insurgency  campaign. 

Shown  in  Figure  5  are  several  event  observations  that  might  be  gleaned  from  streams  of  on-going  intelligence 
reports  and  news  reports.  While  the  number  of  such  events  would  likely  be  very  high  with  an  active  insurgency 
campaign,  we  illustrate  only  a  few  here  to  show  how  they  can  be  used  to  instantiate  the  hypothesized  work  control 
structure. 


Figure  5  Fictional  Insurgency  Campaign:  Stream  of  Observable  Events 

Considering  the  event  observations  depicted  in  Figure  5,  we  now  see  how  these  observations  can  be  used  to 
develop  meaningful  cause-effect  relationships  and  story  lines.  Shown  in  Figure  6  are  the  results  of  incorporating 
these  observations  into  the  emerging  model  of  the  insurgency  campaign.  Although  each  event  could  potentially 
impact  (provide  support  for  or  against)  every  system  influence  pathway,  we  show  only  the  primary  connects  in  this 
diagram.  The  numbers  correspond  to  analyst  estimates  of  the  evidentiary  support  (expressed  as  an  evidence  ratio)  an 
event  reflects  for  the  various  influence  pathways.  They  are  used  in  the  following  Bayesian  equation  to  adjust  the 
evidentiary  strength  (probability)  for  each  system  influence  pathway: 

77  0  _  ES  prior  x  RATIO  evidence 

POSTERIOR  TXT  T?  ATT n  \  1  _ 

\Fe>  prior  X  KA 1 1 UEVIDENCE  )  +  L  Eo  prior 

where  ESPRIOr  represents  the  existing  strength  of  belief  that  the  insurgency  is  actively  emphasizing  a  specific 
pathway  of  influence,  and  ES posterior  indicates  the  level  of  belief  after  considering  the  newly  added  observation.  A 
large  positive  value  for  RATIO EVIDENCe  indicates  strong  support,  a  zero  value  indicates  neutral  support,  and  a  large 
negative  value  indicates  strong  contradictory  evidence.  Thus,  as  time  goes  on,  the  accumulation  of  event 
observations  either  add  support  to  or  detract  support  from  each  of  the  system  influence  pathways.  In  this  manner,  the 
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analyst  is  able  to  maintain  an  on-going  assessment  of  the  evolving  emphasis  and  importance  given  by  the  insurgency 
campaign  to  each  of  its  lines  of  operation. 


Figure  6  Fictional  Insurgency  Campaign:  Evidentiary  Support  for  Work  Control  Structure 


As  seen  from  Figure  6,  a  stream  of  events  can  reflect  a  complex  set  of  influences  within  the  multiple  influence 
pathways  being  pursued  by  a  modem  insurgency  movement.  Additional  analytical  functionalities  within  the 
prototype  tool  suite  provide  the  analyst  with  the  capability  to  identify  the  emergence  of  new  influence  pathways  and 
new  work  system  capabilities.  Thus,  over  time,  the  analyst  is  able  to  maintain  a  working  model  of  an  insurgency 
campaign  -one  that  evolves  as  the  insurgency  movement  adjusts  its  operations  to  overcome  various  obstacles  and  to 
exploit  new  opportunities  as  they  arise.  From  this  model,  the  analyst  can  develop  assessments  of  campaign  progress 
that  can  be  used  by  effects-based  operational  planners  to  guide  their  development  of  diplomacy,  information, 
military,  and  economic  initiatives  in  response  to  the  insurgency  campaign. 
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Figure  7  Fictional  Insurgency  Campaign:  Assessment  of  Relative  Progress 
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Summary 

The  prototype  campaign  analysis  tool  offers  three  distinct  advantages  over  existing  methods  of  intelligence 
analysis.  These  advantages  are  briefly  summarized  as  follows: 

•  Holistic  Framework  By  placing  the  analytical  process  within  the  context  of  an  insurgency  movement’s 
work  control  structure  and  lines  of  operation,  the  prototype  tool  enables  one  to  interpret  the  meaning  and 
significance  of  individual  objects,  events,  and  conditions  within  a  holistic  framework.  Rather  than 
attempting  to  build  situation  awareness  and  understanding  from  purely  a  “bottom-up”  perspective,  the  tool 
allows  the  intelligence  analyst  to  anticipate  the  types  of  intelligence  information  likely  to  be  required 
historically  by  insurgency  movements.  Since  the  tool  is  solidly  grounded  in  current  socio-cognitive  theory, 
it  enables  the  analyst  to  “see”  an  insurgency  movement  from  the  viewpoint  of  how  a  loosely  networked  and 
emergent  type  of  organization  transforms  intent  into  action  through  various  levels  of  knowledge  creation. 
The  holistic  perspective  reflected  in  the  analytic  framework  serves  to  efficiently  guide  the  evidence 
management  process  toward  the  development  of  actionable  targeting  information. 

•  Dynamic  Story  Lines  The  prototype  campaign  analysis  tool  provides  the  systems  effects  analyst  with  the 
capability  to  define  story  lines  within  this  holistic  understanding  in  an  autopoietic  manner.  Thus,  objects, 
events,  and  conditions  relevant  to  predictive  awareness  and  understanding  are  not  required  to  have  fixed, 
universal  semantic  properties  -a  shortcoming  of  current  semantic  web  approaches.  Rather,  the  meaning  of  a 
specific  knowledge  construct  and  its  relationship  to  other  constructs  is  dynamically  determined  by  its 
placement  within  the  overall  framework  of  understanding.  On  the  other  hand,  the  proposed  tool  avoids  the 
pitfalls  of  allowing  a  completely  open-ended  epistemology  by  providing  the  analyst  with  a  common 
framework  for  modeling  the  sensemaking  structure  of  an  organization  operating  in  a  complex  environment. 

•  Operations-Based  Intelligence  Analysis  The  prototype  campaign  analysis  tool  provides  a  common 
knowledge  framework  for  supporting  collaboration  among  three  key  roles  within  the  Joint  military 
commander’s  planning  process:  the  tactical  intelligence  analyst,  the  systems  effects  analyst,  and  the 
operational  planner.  By  “reverse  engineering”  the  process  of  building  an  effective  insurgency  campaign, 
the  tool  serves  as  an  effective  boundary  object  linking  three  communities  of  analysis.  First,  the  tactical 
intelligence  analyst  can  employ  the  tool  to  guide  the  process  of  evidence  management.  Second,  the  systems 
effects  analyst  can  employ  the  tool  to  develop  the  referent  linkages  required  for  understanding  the  causal 
mechanisms  and  influence  pathways  inherent  in  a  specific  insurgency  campaign.  Third,  the  operational 
planner  can  employ  the  tool  to  assess  the  state  of  progress  of  an  insurgency  campaign  and  to  identify  key 
points  of  disruption. 
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